HR Compliance: A Guide for Small Businesses

The first time I thought seriously about HR compliance, it was because I got scared. We had grown to about a dozen people, and a founder friend mentioned offhand that his company had just been through a wage-and-hour claim. Not because they were bad actors. Because they had classified someone as exempt from overtime who legally was not, and nobody had checked.

That conversation sent me down a rabbit hole. What I found is that most of what is written about HR compliance assumes you already have an HR department, a compliance officer, and a legal budget. When you are the founder, the sales lead, and the person who handles HR all at once, that assumption does not hold, so this guide starts from the opposite one and shows how to stay compliant with no HR team at all.

This guide is the version I wish I had found then. It covers what HR compliance actually means, which laws apply to a business your size, where small companies most often get into trouble, and how to build a system that keeps you compliant without hiring a team. I built FirstHR to hold the paperwork this creates, from signed policies to onboarding documents and task deadlines, but the principles here apply no matter what tools you use.

What Is HR Compliance?

HR compliance is the practice of aligning your workplace policies, procedures, and recordkeeping with the employment laws and regulations that apply to your business. It spans the full employment relationship: how you hire, how you pay, how you keep people safe, how you handle leave, and how you part ways. Compliance is not a one-time setup. It is an ongoing obligation that changes as laws change and as your headcount grows.

The word "compliance" makes it sound like a single checkbox, but it is really a stack of separate obligations. Some are federal and apply everywhere. Some are set by your state and can be stricter. Some are local, set at the city or county level, and are multiplying quickly in areas like pay transparency and scheduling. A small business in one state can face a very different compliance picture than an identical business two states over.

Why HR Compliance Matters More for Small Business

HR compliance matters for small businesses because there is no size exemption for the foundational laws, and there is no HR team to catch mistakes. An enterprise that misclassifies a worker has an HR department and a lawyer to fix it. A small business that makes the same mistake has a founder who did not know the rule existed until a penalty notice arrived.

The financial exposure is real. According to the Department of Labor (DOL), the federal minimum wage has held at $7.25 per hour since July 2009, but the penalties for getting employment rules wrong have climbed with inflation.

OSHA (the Occupational Safety and Health Administration) is the clearest illustration. For violations assessed after January 15, 2026, a serious violation reaches $16,550 and a willful or repeat violation reaches $165,514 (OSHA). These are not enterprise-only numbers, and OSHA safety rules apply from your first employee.

There is a quieter cost too. Compliance failures rarely announce themselves. A misclassification sits unnoticed until an employee files a claim. A missing I-9 is invisible until an inspector asks for it. A handbook promise you did not keep is harmless until it becomes evidence in a dispute. The businesses that get hurt are usually not reckless. They are busy, and busy is how gaps form.

The Four Types of HR Compliance

HR compliance breaks into four types: statutory, regulatory, contractual, and union or collective. Understanding the distinction matters because each type comes from a different source and carries different consequences when you get it wrong. Statutory and regulatory obligations are imposed on you by law. Contractual obligations are ones you take on voluntarily and then must honor.

For most small businesses, the first three types are what matter day to day. Statutory and regulatory compliance define the floor you cannot go below.

Contractual compliance is the one people forget. The moment you write "we provide two weeks of paid time off" in an employee handbook or promise a bonus structure in an offer letter, you have created an obligation you must meet. Inconsistency between what you promised and what you do is its own form of risk.

Examples of Compliance at Work

Compliance at work is not an event, and it rarely looks like paperwork. It looks like small repeatable actions inside an ordinary week, each one satisfying a specific rule. The examples below cover all four types above, in the form they take at a company with no HR department.

Read down the first column and the pattern is hard to miss. Every example is a step somebody takes at a specific moment, not a document sitting in a folder. That is why compliance kept in one person's head fails during a busy month, and why the same work attached to a trigger in hiring or payroll does not.

Which Federal Laws Apply at Your Employee Count

Which federal employment laws apply to you depends primarily on how many employees you have. Some laws apply from the first employee. Others phase in at 15, 20, 50, and 100 employees. The staircase below is the most practical way to see your obligations as a small business owner: find your headcount, and you know your baseline.

The FMLA threshold is worth understanding precisely because it trips people up. Under DOL Fact Sheet #28, a covered employer is a private-sector business that employs 50 or more employees in 20 or more workweeks in the current or previous calendar year.

Coverage and eligibility are two separate tests. Even at a covered employer, an individual employee is only eligible if they have worked for you for 12 months, have at least 1,250 hours of service in the 12 months before the leave begins, and work at a location where you have 50 employees within 75 miles.

Stricter state rules are not only a coastal-state phenomenon, and assuming they are is what catches employers in low-regulation states. Wyoming has no income tax, no paid sick leave mandate, and no state FMLA, yet its Fair Employment Practices Act reaches employers with two or more employees, well below the 15-employee floor under Title VII (Wyoming Statutes Title 27).

A five-person business there sits under state discrimination law even though Title VII and the ADA do not reach it yet. W.S. 27-9-106 gives a worker who claims discrimination six months to file a complaint with the Wyoming Department of Workforce Services. Fewer state rules rarely means none, and the ones a state keeps often start at a lower headcount than the federal equivalent.

The Most Common HR Compliance Issues

The most common HR compliance issues for small businesses cluster around a handful of predictable failure points. These are not exotic edge cases. They are the everyday errors that busy owners make because the rules are counterintuitive and nobody is watching until it is too late.

What these issues share is that each one is invisible until it is expensive. That is why the businesses that stay compliant are not the ones with the most legal knowledge. They are the ones with systems that surface these issues on a schedule instead of waiting for an agency to find them.

Wage and Hour: Where Small Errors Get Expensive

Wage and hour mistakes get expensive because they repeat on every paycheck, and under 29 U.S.C. 216(b) an underpaid employee can recover the unpaid wages plus an equal amount in liquidated damages. The core obligations under the Fair Labor Standards Act are simple to state: pay at least minimum wage, pay overtime at time-and-a-half for hours over 40 in a workweek, and keep accurate records. The trouble is in the exceptions.

A common error is misclassifying an employee as exempt from overtime. Many owners assume that paying someone a salary makes them exempt. It does not. Exemption depends on both a salary threshold and the actual duties of the job.

A job title does not settle it either. An employee with a manager title who spends most of their time doing the same work as the people they supervise may not qualify as exempt, regardless of salary. The distinction between exempt and non-exempt is where audits begin.

Off-the-clock work is the other frequent trap. Time spent booting up systems before a shift, answering messages after hours, or working through an unpaid break can all count as hours worked. For hourly employees, those minutes are compensable, and failing to pay them is a violation even when it was unintentional. Accurate time records are your protection here.

Worker Misclassification: Employee or Contractor

Worker misclassification means treating someone as an independent contractor when the law considers them an employee. It is a high-stakes call because it affects taxes, overtime, benefits, and unemployment insurance all at once, so a single wrong call gets expensive on every one of those fronts.

The hard part is that there is no single test. The IRS weighs behavioral control, financial control, and the type of relationship. The DOL applies an economic reality test, which asks whether the worker is really in business for themselves. Many states, led by California's ABC test, apply their own stricter standards.

A worker can be a legitimate contractor under one test and an employee under another. Each agency applies its own test to the law it enforces, so in practice the strictest test that reaches you sets the bar, and you absorb the cost of missing it.

The consequences of getting it wrong include back payroll taxes, unpaid overtime, penalties, and liability for benefits the worker should have received. If you rely on contractors, the safest approach is to classify each one against that strictest test and document your reasoning.

Hiring and Recruitment Compliance

Hiring compliance covers the rules that govern how you advertise a role, screen candidates, and document the decision. Almost all of it applies before anyone is on payroll, which is why it gets missed. The posting, the application form, the interview, and the rejection are each regulated steps, and at a small business one person usually runs all four.

The notice sequence under the Fair Credit Reporting Act (FCRA) is what catches employers who did everything else right. When a third party runs the background check, the disclosure has to be its own document, the candidate has to authorize it in writing, and a rejection based on that report takes two separate notices.

The order of those notices matters. Before you reject anyone over the report, send a pre-adverse action notice with a copy of the report and a summary of the candidate's rights. Once the decision is final, send the adverse action notice with the screening company's contact details and the right to dispute the report (FTC). Skipping the first notice is the common error.

Pay transparency and criminal history rules are where the map changes fastest. Job posting requirements now differ by state and sometimes by city, and ban-the-box laws control when in the process you may ask about convictions. Check both for every state you recruit in, not only the one you sit in.

The last row of the hiring table is the one that decides cases. Consistency is what makes a hiring decision defensible: the same questions, the same scoring, the same reference checks for everyone in the running. A structured hiring process costs less than defending an unstructured one.

I-9 and Work Authorization

I-9 compliance requires verifying the identity and work authorization of every employee using Form I-9, completing it on time, and retaining it correctly. Every hire is covered from your first employee onward, with no small-business exemption, and paperwork fines are assessed for each individual the error involves.

The timing rules are strict. The employee completes Section 1 no later than their first day of work. The employer completes Section 2, verifying documents, by the end of the third business day after the start date. Using the current version of the form matters just as much, and using an outdated one is itself a violation.

Which edition counts as current has changed, and two dates on the form tell you where you stand: the edition date at the bottom and the expiration date at the top. Per U.S. Citizenship and Immigration Services (USCIS), the current edition date is January 20, 2025, and employers may also still use the August 1, 2023 edition that carries an expiration date of May 31, 2027.

The other August 1, 2023 edition, the one printed with a July 31, 2026 expiration date, is past its date and no longer usable. Employers running an electronic I-9 had to move their system to the May 31, 2027 version by July 31, 2026.

The most reliable way to stay compliant is to make I-9 completion a fixed step in onboarding with a hard deadline, not a task someone remembers to do.

Employee Benefits Compliance

Employee benefits compliance runs on plan documents and headcount thresholds rather than daily behavior, which is why it stays quiet until it does not. Offering health coverage, a retirement plan, or pre-tax premium deductions creates federal obligations, and several of them attach the moment the plan exists rather than when you reach a certain size.

The Affordable Care Act (ACA) threshold is the one small employers miscount. You are an applicable large employer for a year if you averaged at least 50 full-time employees, including full-time equivalents, during the prior year, where full time means 30 hours a week or 130 hours a month (IRS).

Part-time hours roll up into those equivalents, so a heavily part-time workforce can cross the line while headcount still looks small. Crossing it turns on ACA reporting as well as the coverage obligation.

COBRA counts the same way. It reaches private-sector group health plans at employers with at least 20 employees on more than half of their typical business days in the prior calendar year, and part-time employees count as fractions toward that number (DOL).

Benefits are compensation, so anti-discrimination law follows them. An employer may never consider race, color, sex, national origin, or religion in benefits decisions, and age-based differences are permitted only in narrow circumstances (EEOC). Eligibility rules built on hours or employee class are fine, provided you apply them the same way to everyone.

The tax code runs a second, separate test. A cafeteria plan is the kind of plan that lets employees pay premiums with pre-tax dollars. If yours favors highly compensated employees on eligibility, contributions, or benefits, you must include in their wages the value of the taxable benefits they could have selected (IRS Publication 15-B).

A written eligibility rule applied the same way every time satisfies both tests, and part-time eligibility is where that rule usually gets bent.

Two documents cause most of the paperwork trouble. Under 29 CFR 2520.104b-2, the summary plan description has to reach each participant within 90 days of becoming covered, and a newly established plan gets 120 days from the day it first comes under ERISA, the Employee Retirement Income Security Act.

Form 5500 is the other one. It is due on the last day of the seventh month after the plan year ends, which is July 31 for a calendar-year plan (IRS). Unfunded or fully insured welfare plans with fewer than 100 participants are generally exempt, which covers most small employers.

State law adds a layer here too. Several states run auto-enrollment retirement programs that require you either to join or to offer a qualifying plan of your own, and the trigger often sits far below 50 employees. Check whether your state mandates a retirement plan before assuming benefits are optional at your size.

Recordkeeping and Retention

Compliance recordkeeping means keeping the documents the law requires, for the periods the law requires, in a form you can produce on demand. Missing records are dangerous because they often convert a defensible position into a provable violation. When an auditor asks for a record you cannot produce, the absence itself is the finding.

Different records carry different retention periods. Payroll records under the FLSA must be kept for at least three years, and records used to compute pay for two years (DOL Fact Sheet #21). I-9s follow the three-years-or-one-year-after-termination rule. Tax records, benefit documents, and hiring records each have separate timelines. When multiple rules overlap on a single document, keep it for the longest applicable period.

For small businesses, the practical failure is seldom about knowing the retention rules. It is about storage. Records scattered across email, paper folders, and personal drives cannot be produced quickly, and the person who knew where everything was may have left. Centralizing personnel records in one system solves both problems.

The Reports and Filings You Owe

HR compliance reporting is the part of recordkeeping that leaves the building: the returns, logs, and workforce reports you file with an agency on a fixed schedule. Each one is a small job with a hard deadline, and a missed deadline is usually a penalty rather than an argument you can win later.

Nothing on that list is optional and nothing on it is difficult, which is exactly why it slips. Give each filing an owner and a date, and review the compliance calendar at the start of every quarter. The OSHA injury logs in particular have to be maintained all year to be postable in February.

The EEO-1 row is the one in flux. The EEOC still describes the report as mandatory and annual, but in July 2026 the agency proposed removing the requirement entirely. As of September 2026 the proposal was not final and the 2025 collection had not opened, so keep the filing on your calendar until a final rule says otherwise.

HR Compliance Best Practices

The best practices for HR compliance are consistent across company sizes, but the implementation looks different when you do not have an HR team. At a small business, the goal is to build compliance into the workflows you already run, so it happens without a dedicated person driving it.

Consistency deserves special emphasis because it is the practice small businesses most often violate without realizing it. Discrimination claims rarely come from overt bias. They come from treating two similar employees differently: disciplining one for lateness while letting another slide, granting one person's schedule request and denying another's.

An HR Compliance Checklist for Small Businesses

A practical compliance checklist for a small business covers the recurring obligations that must happen for every hire and on an ongoing basis. Use this as a starting framework, then layer your state and local requirements on top.

Much of this checklist maps directly onto the hiring process, which is why compliance and onboarding are so tightly linked. Building these steps into your new hire workflow means they happen every time, not just when someone remembers.

HR Compliance Roles and Responsibilities

In a business without an HR department, compliance responsibilities are split whether or not anyone wrote them down. The owner holds the legal accountability, the person who hires carries the hiring rules, whoever runs payroll carries the pay rules, and employees carry the parts only they can do. Naming those owners out loud is most of the work.

The payroll row needs a note: FirstHR is an onboarding and HR platform, not a payroll provider, so classification and tax filing sit with your payroll provider or bookkeeper. What matters is that every row has a name in it. Compliance failures at small companies are usually ownership gaps rather than knowledge gaps.

Employee Responsibilities and a Culture of Compliance

Employee compliance is the share of this that only employees can carry. Accurate timekeeping, signed acknowledgments, and finishing required training depend on them, and a policy nobody read is a policy you cannot enforce. Collect acknowledgments during onboarding, and again whenever the handbook changes.

A culture of compliance is what keeps the system standing when nobody is watching. It comes from three things: leaders following the rules they publish, the compliant path being the easy path, and a way to raise a concern that does not cost the person raising it. Retaliation against someone who reports a problem is its own violation, and it turns a fixable issue into a claim faster than the original problem would have.

How to Manage Compliance Without an HR Department

Managing HR compliance without an HR department comes down to replacing a person's memory with a system's reliability. The reason compliance fails at small companies is almost never ignorance of the law. It is that the person responsible got busy and a deadline slipped. Systems do not get busy.

The move that pays off most is to automate the repeatable, deadline-driven work. I-9 completion tied to a start date. New hire reporting triggered on hire. Policy acknowledgments captured with e-signature during onboarding. Records stored automatically with retention periods attached.

Once those steps run on triggers instead of memory, the most common failure points close. This is exactly what FirstHR automates for small and growing teams: the compliance steps of hiring happen as part of the onboarding flow, and every signed document lands in an audit-ready record.

Software does not replace judgment. For genuinely complex questions (a multi-state expansion, a difficult termination, a novel accommodation request), a periodic review with an employment attorney is worth the cost. But those situations are the exception. The day-to-day compliance work that trips up most small businesses is repeatable, and repeatable work is exactly what a system handles better than a person.

DIY, Software, or PEO: Choosing Your Approach

Small businesses generally manage compliance one of three ways: do it yourself, use HR software, or outsource to a PEO (professional employer organization). The right choice depends on your headcount, your complexity, and how much of the liability and cost you want to carry yourself.

For most small and growing teams, software hits the balance point. Pure DIY works at the smallest sizes but gets risky as you grow and the moving parts multiply. A PEO removes the most liability, but it is the most expensive option and means giving up control over your own HR. Software sits in between: it automates the repeatable compliance work and keeps audit-ready records without the cost or loss of control of full outsourcing.

A fourth option pairs with any of the three: hiring an HR compliance consultant for a defined project instead of an ongoing relationship. A first handbook, an annual compliance review, an I-9 self-audit, or a move into a second state are bounded pieces of work where a few hours of expert time costs less than the mistake. The recurring work still runs on your own system afterward.

Whichever approach you choose, the first moves are the same: confirm which laws apply at your headcount, get your hiring paperwork right from day one, and give every recurring filing an owner and a date. Start there, then build out the rest one deadline at a time.

Frequently Asked Questions